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I.  INTRODUCTION 


A  microprocessor  has  been  studied  for  its  vulnerability  against  cosmic 
ray  induced  errors  such  as  single  event  upset  (SEU)  and  latch-up.  Earlier 
reports  on  the  observation* of  SEU  in  microprocessors  were  followed  by 
several  mentions  of  test  results  in  the  SEU  summary  format.^’^  As  the  needs 
for  advanced  control  and  computing  capabilities  increase  in  satellite  applica¬ 
tions,  a  wide  range  of  microprocessors  as  well  as  other  microcircuits  will  be 
considered  for  use.  Therefore,  the  ability  to  predict  rates  of  upset  of  these 
devices  in  space  is  becoming  an  important  factor.  In  this  report  we  would 
like  to  limit  our  attention  to  microprocessors  (including  bit  slice  pro¬ 
cessors),  report  on  the  various  SEU  test  techniques  oriented  towards  pre¬ 
dicting  upset  rate  in  space,  and  present  some  predictions  based  on  recently 
conducted  tests. 

The  prediction  of  a  microprocessor  SEU  rate  in  space  requires  both  the 
laboratory  SEU  test  data  and  some  circuit  analysis,  in  addition  to  the  general 
knowledge  of  program  execution  procedures.  In  the  future,  circuit  simulation 
alone  can  be  used  for  the  upset  rate  determination  but,  as  yet,  simulation 
techniques  have  not  reached  the  critical  level  of  maturity  where  no  labora¬ 
tory-test  confirmation  is  needed.  Each  confirmation  refines  the  circuit- 
simulation  technique,  and  eventually  the  latter  may  become  the  chief  means  of 
predicting  the  upset  rate.  Thus,  the  existence  of  a  published  extensive  and 
readily  accessible  data  base  of  experimental  SEU  test  results  is  extremely 
valuable  in  the  process  of  evolution  of  predictive  techniques  based  on  circuit 
simulation  and  device  modeling.  Extensive  data  bases  already  have  been  pub¬ 
lished  for  predicting  SEU  rates  of  RAMs  and  relatively  simple  logic  devices, 
and  their  use  is  fairly  routine.  In  contrast,  microprocessor  data  bases  are 
just  beginning  to  emerge,  and  it  is  not  entirely  clear  how  one  should  use  what 
little  there  is.  Microprocessor  SEU  test  data  need  to  be  presented  differ¬ 
ently  from  those  pertaining  to  simple  latches  or  RAMs,  where  the  cross-section 
vs  LET  curve  has  a  simple  meaning  and  is  readily  usable  for  estimating  the 
upset  rate  in  space.  In  order  to  obtain  comparable  data  for  a  microprocessor, 
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II.  MICROPROCESSOR  TEST  METHODS 


In  devising  a  test  method  for  a  microprocessor,  we  begin  by  examining  all 
possible  functional  elements.  If  we  can  test  the  SEU  vulnerability  of  each 
functional  element,  the  combined  rate  of  SEU  in  space  can  be  estimated  from 
the  program  execution  pattern.  This  "macroscopic"  (functional  element  as 
opposed  to  individual  circuit)  testing  of  many  functional  elements  can  be 
accomplished  "externally"  using  the  standard  instruction  sets  (i.e.,  there  is 
no  need  to  obtain  test  device  circuits  especially  fabricated  for  microscopic 
SEU  testing.)  It  should  be  remembered  that  macroscopic  testing  may  be  the 
only  available  means  of  ascertaining  the  SEU  rate  of  a  commercially  available 
microprocessor,  since  neither  a  detailed  knowledge  of  the  device  nor  test 
circuits  will  in  general  be  readily  obtainable. 

While  testing  various  microcircuits,  we  have  considered  and  developed 
five  methods  of  microprocessor  testing.  After  briefly  defining  these  below, 
we  will  introduce  each  one  in  some  detail  with  the  help  of  examples  of  devices 
actually  tested.  The  methods  we  will  consider  are: 

1.  Self-testing  Single  Computer  Method:  a  microprocessor  can  be  tested  in  a 
simple  computer  configuration,  e.g.,  single  board  computer.  The  proces¬ 
sor  "self-tests"  and  the  result  of  the  self-test  can  be  visually  recog¬ 
nized  either  by  a  CRT  displayed  output  pattern  or  even  by  a  simple  LED. 

2.  Controller  Assisted,  Single  Computer  Method:  an  external  controller 
interrogates  the  operation  of  the  microprocessor  under  test  by  comparing 
its  outputs  with  the  "true"  values  stored  in  an  external  memory  table. 

3.  Controller  Assisted,  Golden  Chip  Method:  an  external  controller  compares 
the  outputs  of  the  microprocessor  under  test  with  the  outputs  of  a 
"standard"  microprocessor  (golden  chip)  operation  under  the  same  pro¬ 
gram.  In  the  above  three  methods  the  microprocessor  under  test  auto¬ 
matically  fetches  the  instructions  stored  in  memory  (RAM  or  ROM)  whenever 
it  requires  them. 

4.  Controller  Dominated,  Single  Computer  Method:  it  is  possible  for  the 
controller  to  "take  over"  the  function  of  the  simple  computer  memory  by 
Introducing  instructions  whenever  the  microprocessor  under  test  requires 
them.  Here  the  instructions  are  "force-fed,"  and  the  microprocessor 
under  test  effectively  single-steps  through  the  given  program  sequential¬ 
ly.  The  same  controller  interrogates  the  outputs  of  each  step. 


5.  Controller  Dominated,  Golden  Chip  Method:  this  is  another  single-step 

method.  The  interrogation  of  upsets  consists  of  comparing  the  outputs  of 
the  microprocessor  under  test  and  those  of  a  "standard"  microprocessor 
(golden  chip)  operating  under  the  same  program.  The  controller  stores 
the  error  data. 

In  all  methods,  except  for  the  first  one,  the  speed  of  the  operation  is 
limited  by  that  of  the  controller  during  the  handshake.  The  controller  is 
usually  a  micro-  or  mini-computer  which  requires  tens  of  microseconds  to 
collect  and  store  data.  Therefore,  the  clock  frequency  of  a  DUT  must  be 
interrupted  while  the  controller  collects  upset  data.  A  concept  of  "average 
clock  frequency"  is  introduced  to  specify  the  average  clock  rate  during  the 
test  period.  A  comparison  (pros  and  cons)  of  the  five  test  methods  is  made  in 
Table  1. 
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Table  1.  A  Comparison  of  the  Five  Test  Methods 
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III.  ILLUSTRATION  OF  TEST  METHODS:  DETAILED  EXAMPLES 


A.  4-BIT  SLICE  PROCESSOR  (2901)  (METHOD  4) 

The  block  diagram  of  the  device  is  shown  in  Figure  la.  The  2901  is  a  4- 

bit  slice  processor.  It  is  essentially  a  static  device,  and  the  clock  can  be 

operated  at  any  frequency  up  to  15  MHz.  The  RAM  section  (16  x  4  bit),  a  Q 

register,  and  A  and  B  port  latches  (2x4  bit)  are  the  only  memory  elements, 
and  all  were  tested  for  SEU.  The  ALU  is  used  each  time  the  data  is  placed  in 
the  Q  register  or  the  RAM.  Therefore,  a  change  in  the  writing  frequency 
alters  the  degree  of  the  ALU  circuit  involvement  and  enables  us  to  measure  the 
SEU  vulnerability  of  ALU. 

This  device  Is  much  like  a  SRAM  (or  D  flip-flop)  from  the  standpoint  of 
SEU  testing.  We  used  a  simple  version  of  test  method  no.  4,  in  which  the  test 
clock  frequency  is  limited  to  about  10  kHz. 

The  software  instruction  sequence  of  our  SEU  test  procedure  is  shown  In 
Figure  2.  The  clock  pulse  controls  the  A-  and  B-  latches  as  well  as  the  WRITE 
RAM  process.  The  clock  line  must  be  kept  "high"  during  the  read  cycle  in 
order  to  minimize  errors  associated  with  corrections  during  data  analysis. 

The  clock  line  was  "low”  for  one  waiting  cycle,  and  "high”  for  the  next 
cycle.  This  process  was  repeated  many  times  until  a  statistically  significant 
number  of  upsets  were  obtained. 

There  are  many  versions  of  the  2901,  fabricated  in  TTL,  ECL,  and  CMOS 
with  varying  vulnerabilities  to  SEU.  The  test  results  of  these  devices  are  pre 
sented  and  discussed  in  the  following  section,  along  with  the  results  for  the 
same  device  type  tested  earlier  using  a  simpler  version  of  test  method  no.  5.* 

The  2901  processor  Is  not  a  full  microprocessor,  and  it  cannot  "run  by 
itself."  Therefore,  one  can  test  it  only  with  method  nos.  4  or  5.  We 
selected  method  no.  4  because  the  test  preparation  time  was  relatively  short 
and  because  observation  of  the  RAM,  port  latches,  and  Q  register  could  be 
readily  implemented. 


*K.  L.  Wahlin,  private  communication. 
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Functional  Elements  of  Microprocessors,  (a)  2901,  (b)  MD2815,  and 
(c)  8  x  300  and  8  x  305. 
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Figure  1.  Functional  Elements  of  Microprocessors,  (d)  M6800,  (e)  1802,  and 
(f)  NSC 800  and  Z-80. 
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Figure  2.  The  "2901"  Test  Procedure 
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16-BIT  MD2815  PROCESSOR  (METHOD  4) 


The  MD2815  control  unit  (CU)  of  the  McDonnell  Douglas'  1750A  micro¬ 
processor  (CMOS/SOS)  contains  the  microprogram  ROM  and  the  nexc-lnstructlon 
logic  to  generate  the  next-microprogram  addresses  In  the  sequential  operation 
of  the  microprocessor  as  shown  In  Figure  lb.  The  next-instruction  logic 
consists  of  a  microprogram  counter  (PC),  an  Increraenter  (INCR),  a  register  to 
save  the  program  counter  (SV),  an  Iteration  counter  (C),  and  an  Instruction 
decode  logic.  The  system  timers  IA  and  IB  are  a  part  of  the  Interrupt  handing 
logic.  This  device,  just  like  the  2901,  Is  a  building  block  of  a  micro¬ 
processor,  and  the  test  procedure  used  In  the  2901  was  also  applicable  for 
MD2815.  We  used  test  method  no.  4  in  order  to  Interrogate  the  PC  register  and 
the  IK  x  40-bit  microcode  ROM.  The  reason  behind  choosing  this  method  Is  the 
same  as  that  stated  In  the  previous  section. 

C.  8-BIT  MICROCONTROLLERS  AND  MICROPROCESSORS  (METHODS  1,  2,  AMD  5) 

The  8X300  and  8X305  (manufactured  by  Signet lcs  In  full  ECL  and  LS  TTL  for 
I/O)  are  "old''  but  still  very  useful  processors.  The  8X300  was  Introduced  in 
1968  and  the  8X305  In  1972,  and  both  devices  have  the  same  functional  elements 
as  shown  in  Figure  lc.  These  are  the  sixteen  8-bit  data  registers,  one  13-bit 
program  counter,  one  13-bit  address  register,  one  16-bit  Instruction  register, 
one  8-bit  1/0  latch,  the  ALU,  and  the  control  and  timing  logic  circuits.  The 
devices  lack  the  complexity  of  the  present  level  microprocessor,  and  therefore 
they  are  called  microcontrollers.  The  clock  frequency  can  be  varied  from  DC 
to  10  MHz.  Since  operation  over  the  design  range  of  frequencies  was  an 
important  consideration,  we  used  test  method  no.  2.  During  the  test,  16  data 
registers,  the  program  counter,  and  the  ALU  were  interrogated  for  upset,  since 
these  were  representative  of  the  full  set  of  functional  elements  of  the 
device. 

The  6800  NM0S  microprocessor  (Motorola)  consists  of  several  functional 
groups  such  as  two  8-bit  accumulators  (A  and  B),  one  16-bit  index  register 
(IX),  one  16-bit  stack  pointer  (SP),  one  16-bit  program  counter  (PC),  one  6- 
bit  condition  code  register  (CCR),  ALU,  and  the  control  logic  as  shown  in 
Figure  Id.  The  clock  frequency  must  be  kept  between  0.1  and  2.0  MHz.  Thus, 


again  we  used  method  2  to  check  A,  B,  IX,  SP,  PC,  CCR,  and  ALU  elements  for 
SEU. 

The  1802  microprocessor  was  designed  over  a  decade  ago,  and  the  radiation 
hardened  version  of  1802  has  been  used  in  spacecraft  applications  where  the 
radiation  environment  is  particularly  severe  such  as  that  in  case  of 
Galileo.  There  is  no  minimum  frequency  requirement  (the  system  can  be  held  in 
a  static  mode),  and  maximum  clock  frequency  is  about  6  MHz.  The  system  has 
one  8-bit  data  register  (accumulator  D),  one  1-bit  data-flag  (OF),  sixteen 
scratch  resisters  (R),  one  4-bit  program  counter  selector  (P),  one  4-bit  stack 
pointer  selector  (X),  one  4-bit  high  order  instruction  bits  holder  (N),  one  4- 
bit  low  order  instruction  bits  holder  (I),  one  8-bit  old  -X  and  -P  holder  (T), 
one  1-bit  interrupt  enable  flag  (IE),  one  output  flip-flop  (Q),  one  ALU,  and 
the  control  logic  as  shown  in  Figure  le.  We  used  method  no.  2  to  test  15  R's, 
D,  N,  Q,  and  ALU.  In  addition,  we  employed  method  no.  I  to  check  operation 
with  a  set  of  simple  but  well  mixed  instructions. 

While  testing  the  above  devices  under  method  no.  2,  we  encountered  a 
problem  connected  with  an  occasional  SEU  occurring  either  in  the  instruction 
register  or  in  the  program  counter.  Following  such  an  event,  the  single  board 
computer  would  sometimes  lose  track  of  Itself,  and  a  catastrophic  failure 
would  result.  To  circumvent  this  type  of  failure,  we  installed  a  watchdog 
timer  which  would  log  the  failures  and  re-initialize  the  microcomputer.  The 
total  number  of  such  failures  yielded  the  combined  error  rate  of  PC  and  the 
instruction  register. 

An  alternative  way  to  handle  the  recovery  from  catastrophic  failure  is  to 
use  method  nos.  4  or  5.  While  testing  the  following  two  8-bit  micro¬ 
processors,  we  employed  method  no.  5.  Space  does  not  permit  a  description  of 
the  many  unique  features  of  this  method.  A  detailed  example  of  its  applica¬ 
tion  is  provided  in  Ref.  7. 

Both  the  Z80  (manufactured  by  Zilog  in  the  NMOS  technology)  and  the 
NSC800  (manufactured  by  National  in  the  CMOS  technology)  have  identical 
instruction  sets.  A  block  diagram  of  NSC800,  which  also  represents  the  Z80, 
is  shown  in  Figure  If.  The  microprocessors  consist  of  eight  16-bit  register 


arrays  (AFHLDEBCA’F'H'L'D'E'B'C’ ) ,  two  index  registers  (IX,  IY),  two  8-bit 
vectors  (I,  R),  one  stack  pointer,  one  program  counter,  one  8-bit  instruction 
register,  one  6-bit  flag,  ALU,  and  the  control  logic. 

The  clock  frequency  of  NSC800  can  be  varied  from  16  kHz  to  3  MHz,  whereas 
Z80  has  the  lower  limit  of  0.1  MHz  and  the  upper  limit  of  3.0  MHz.  (The  clock 
for  NSC800  can  be  stopped  without  losing  any  data  only  at  some  certain  phase.) 

D.  16-BIT  MICROPROCESSOR  (METHOD  2) 

The  80C86  microprocessor,  manufactured  by  Harris  in  CMOS  technology  (the 
mask  number  was  1750),  was  tested  using  test  method  no.  2.  All  internal 
registers,  counters,  and  latches  are  of  static  design.  The  clock  frequency 
can  vary  from  DC  to  5  MHz.  It  functionally  consists  of  four  16-bit  segment- 
register-files  (code  segment-CS,  stack  segment-SS,  data  segment-DS,  extra 
segment-ES),  four  16-bit  general  registers  ( accumulator-AX,  base-BX,  count-CX, 
data-DX),  four  16-bit  special  registers  (stack  pointer-SP,  base  point-BP, 
source  index-SI,  destination  index-DI),  one  16-bit  instruction  pointer  (IP), 
one  16-bit  status  flag  (FLAGs),  ALU,  and  the  control  and  timing  logic  as  shown 
in  Figure  lg.  Both  CMOS/EPI  and  CMOS/Bulk  versions  were  tested  using  method 
no.  2.  We  needed  to  test  the  device  in  a  reasonably  short  time  scale. 
Therefore,  we  chose  test  method  no.  2. 

E.  OTHER  DEVICES 

The  block  diagram  of  8085  and  9900  are  shown  in  Figure  lh,  and  li , 
respectively.  The  Sandia  verion  of  8085  (SA3000)  was  tested  by  methods  no.  1 
and  2,  and  9900  (also  9989)  was  tested  by  test  method  no.  3.  ^ 

All  five  test  methods  have  been  used  since  1980.  Method  2  may  in 
principle  be  replaced  by  test  method  3  or  vice  versa.  However,  each  test 
method  provides  some  unique  features,  and  it  will  have  its  own  place  in  the 
SUE  testing. 


IV.  METHODS  OF  UPSET-RATE  PREDICTIONS 


There  are  three  stages  in  the  process  of  estimating  the  upset  rate  of  a 
microprocessor.  First,  we  need  to  select  an  appropriate  test  method,  using 
selection  criteria  such  as  microprocessor  architecture,  operating  speed, 
instruction  formats,  circuit  design,  and  application  software.  Second,  it  is 
necessary  to  deduce  the  SEU  cross-section  as  a  function  of  LET  for  various 
registers  and  any  other  elements  (using  appropriate  ground-test  procedures  and 
microprocessor  element  utilization  factors  during  software  executions). 
Finally,  using  an  appropriate  physical  device  model,  we  can  combine  data  from 
step  2  with  a  radiation  environmental  model  to  compute  upset  rate  in  that 
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environment.  ‘ 

While  the  use  of  a  cross-section  vs  LET  curve  to  predict  the  upset  rate 
of  a  RAM  is  quite  straightforward,  matters  are  not  nearly  as  simple  in  the 
case  of  microprocessors.  A  considerable  amount  of  analysis  is  required  to 
come  up  with  a  cross-section  curve  which  will  yield  realistic  upset-rate 
predictions  for  a  microprocessor. 

For  a  bit  slice  processor  (e.g. ,  Figure  la),  a  typical  micro-instruction 
should  be  taken  into  consideration  in  order  to  estimate  the  number  of  ’’live 
and  relevant"  registers.  By  "live  and  relavant”  register,  we  mean  those 
registers  whose  SEU  will  cause  observable  errors  during  the  relavant  program 
execution.  For  example,  if  addition  of  two  numbers  were  carried  out  soon 
after  loading  of  the  two  numbers,  only  two  registers  and  the  ALU  would  be 
vulnerable  during  the  time  period.  Here,  we  can  come  up  with  a  model  of 
typical  duty  cycle  for  the  vulnerability  through  Monte  Carlo  simulation  using 
a  set  of  instructions,  or  analysis  of  vulnerability  using  the  actual  existing 
applications  program.  A  simple  first  order  model  using  a  less  sophisticated 
approximation  can  always  be  applied.  In  the  past,  for  example,  the  average 
SEU  rate  per  bit  based  on  upset  cross-sections  measured  for  the  various  regis¬ 
ters  was  simply  multiplied  by  the  number  of  total  bits  to  estimate  the  device- 
wise  SEU  rate.  This  may  over-estimate  the  device  upset  rate  by  as  much  as 
one  order  of  magnitude. 


* 


In  the  more  standard  microprocessor,  the  classification  of  various  func¬ 
tional  elements  into  the  "live  and  relevant  group"  as  a  function  of  time  can 
be  always  accomplished  in  similar  manner.  However,  a  first  order  approxima¬ 
tion  can  be  done  quickly  knowing  that  the  program  counter  and  the  instruction 
decoder  are  continuously  being  used,  whereas  the  use  of  other  elements  is  less 
frequent.  More  advanced  microprocessors  such  as  the  80C86  "look  ahead"  to  the 
next  instructions  and  even  hold  several  bytes  of  the  instruction  stream  within 
the  processor.  In  these  devices,  consideration  of  the  duty  cycle  alone  can 
provide  a  first  order  approximation  of  the  upset  rate  of  the  whole  device. 
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V.  UPSET-RATE  PREDICTION  RESULTS 


In  this  section  we  present  detailed  results  for  the  three  devices  dis¬ 
cussed  above.  Several  versions  of  the  bit-slice  microprocessor  are  con¬ 
sidered.  The  6800  and  80C86  microprocessors  were  chosen  as  examples  of  "old 
and  "new"  microprocessor  types,  respectively.  Additional  test  results  and 
upset  rates  for  other  recently  tested  devices  are  also  shown  in  Table  2. 

A.  4-BIT  SLICE  PROCESSOR  (2901) 


We  have  tested  commercially  available  Am290l's  manufactured  by  AMD.  These 
are  presently  available  in  B  (low  power  Schottky)  and  C  (mostly  ECL  with  some 
low  power  Schottky)  versions.  The  SEU  vulnerability  of  the  RAM,  the  Q  regis¬ 
ter,  and  the  port  latches  for  Am2901B  are  shown  in  Figures  3a,  3b,  and  3c, 
respectively.  Similar  curves  for  Am2901C  are  shown  in  Figures  4a,  4b,  and  4c, 
respectively. 

The  SEU  rate  of  the  device  was  not  dependent  on  the  clock  frequency, 
which  agrees  with  an  earlier  observation  on  a  NMOS  microprocessor. 1  Also,  the 
errors  arising  from  the  ALU  were  insignificant  in  this  device.  The  RAM  cross- 
sections  were  mainly  taken  from  unaddressed  storage  elements.  The  probability 
of  upset  during  the  addressed  elements  has  been  reported  to  be  lower. 

However,  at  most  only  one  out  of  16  can  be  addressed,  and  so  this  fact  does 
not  affect  the  total  response  of  the  device.  The  bit  pattern  used  to  simulate 
a  common  program  was  50%  "1"  and  50%  "0." 

It  was  reported  earlier  that  the  average  Krypton  or  Argon  fluence  for  one 
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upset  per  Am2901B  was  a  few  hundred  particles/cm  .  Our  results  agree  with 
that  value.  However,  our  interest  is  to  produce  the  upset  rate  in  space  due 
to  cosmic  rays,  and  not  to  be  content  with  measuring  the  laboratory  upset  rate 
only.  Now,  how  can  we  relate  the  measured  cross  sections  to  the  upset  rate  in 
space?  The  answer  lies  in  the  software  programming  of  Am2901B.  In  order  to 
predict  an  upset  rate  in  space  from  the  above  data,  a  general  programming 
knowledge  of  the  microprocessor  is  needed. 


CROSSSECTION 
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For  example,  one  can  say  that  about  1/2  of  the  2901B  Instruction  set 
deals  with  the  manipulation  of  a  stored  value  in  the  RAM  and  a  value  in  the  Q 
register  (e.g.,  ADD  (Q)  and  (RAM  address  1)  before  storing  the  result  in  (RAM 
address  2)).  In  this  mode  of  operation,  we  use  the  Q  register  and  only  2/16 
of  the  RAM  space.  The  rest  of  the  instruction  set  in  this  model  deals  with 
two  numbers  in  the  RAM.  Here,  we  do  not  use  the  Q  register.  Then,  on  the 
average,  the  programming  duty  cycle  of  the  Q  register  is  50%,  whereas  that  of 
the  RAM  is  16%.  Within  the  program,  an  SEU  error  in  the  port  latches  has 
little  effect  on  the  total  upset  rate.  Therefore,  we  can  calculate  the  func¬ 
tional  upset  cross  section  for  Am290lB  in  this  typical  program  by  using  the 
three  individual  cross-section  curves  as  shown  in  Figure  3d  (composite 
curve).  Using  the  curve  in  the  figure,  we  can  calculate  the  upset  rate  in 
space  with  the  methods  described  by  Petersen  or  Adams.®* ^  It  must  be  remem¬ 
bered  that  this  result  Is  based  on  one  particular  mix  of  program  routines.  A 
similar  calculation  can  be  made  given  another  mix  of  programming  routines. 
However,  without  the  help  of  the  three  curves  as  shown  in  Figure  3a,  b,  and  c 
it  would  have  been  impossible  to  proceed.  Also,  if  one  were  to  include  100% 
of  RAM  and  100%  of  the  Q  register,  the  upset  prediction  would  be  over¬ 
estimated  by  a  factor  of  about  6. 

The  Sandia  National  Laboratory  has  produced  a  CMOS  version  of  2901. 

Cross  coupled  resistors  of  approximately  80K  ohm  were  used  in  critical 
cells.  Since  the  device  was  inherently  very  strong  against  SEU,  we  used 
300  MeV  krypton  and  451  MeV  xenon  Ions  at  the  88-inch  cyclotron  facility  for 
extensive  SEU  testing.  The  results  are  summarized  in  Table  2. 

The  krypton  and  zenon  Ions  used  in  this  test  have  become  available  only 
recently.  The  electron  cyclotron  resonance  (ECR)  heavy-ion  source  was  first 
successfully  used  for  SEU  and  latch-up  testing  at  the  88-inch  cyclotron  facil¬ 
ity  (LBL).  The  ECR  source  enables  us  to  utilize  higher  energy  and  higher  Z 
ions  for  testing.  The  summary  of  representative  ions  presently  available  at 
the  88-inch  cyclotron  facility  is  shown  in  Table  3. 


Table  3*  ECR  Ion  Beams  Used  In  SEU  Testing 


Element 


Atomic  Mass 
No.  No. 


Energy  dE/ dX 
(MeV)  (MeV/  mg/cnr) 


Accelerator  Beam 
Facility  Duty  Cycle 


B.  M6800  MICROPROCESSOR 

The  device  is  fabricated  by  Motorola  in  fMOS.  We  used  three  test  programs 
under  test  method  no  2:  (l)  The  first  one  tested  A(8-bit),  B(8-bit), 

X(I6-bit),  SP(l6-bit),  and  F(6-bit)  registers  (see  Figure  Id).  The 
X-register,  for  example,  was  tested  by  placing  a  known  pattern  on  it  during 
the  exposure,  and  reading  it  some  time  later  to  check  for  errors.  Over  the 
years,  this  type  of  interrogation  technique  has  been  used  in  testing  RAMs  in  a 
static  condition.  In  this  test  the  program  counter  and  the  instruction 
register  are  continuously  exercised  while  the  registers  are  static.  Hence, 
this  test  is  called  "serai-static."  We  summed  all  errors  resulting  in  catas¬ 
trophic  failure,  such  as  an  unexpected  jump  of  the  program  counter,  and  termed 
them  the  program  counter  and/or  instruction  decoder,  "PCID,”  error.  The  above 
results,  as  well  as  the  semi-static  upsets,  are  shown  in  Figure  5a. 

Another  program  sequence  to  test  the  microprocessor  involved  writing  a 
pattern  on  the  x-register  and  transferring  the  contents  of  the  x-register  to 
the  SP  register,  then  back  to  the  x-register,  etc.,  for  a  given  time,  in  order 
to  observe  the  bit  error.  The  microprocessor  was  programmed  to  perform  the 
transfer  task  only  during  exposure  to  beam.  In  this  fashion,  we  tested  A,  B, 
X,  and  SP.  In  some  cases  the  ALU  was  placed  in  the  program  loop  to  test  the 
vulnerability  of  the  ALU  section.  As  before,  we  encountered  errors  in  the 
"PCID"  category.  The  results  are  shown  in  Figure  5b.  We  call  this  test 
"semi-dynamic."  The  cross-section  vs  I£T  curve  of  the  "PCID"  in  the  semi¬ 
static  test  overlaps  almost  identically  with  that  of  the  "PCID"  curve  in  the 
semi-dynamic  test  results.  This  result  was  expected,  since  they  are  essen¬ 
tially  the  same  exercise  as  far  as  the  program  counter  and  the  instruction 
decoder  are  concerned. 

The  vulnerability  of  A,  B,  X,  and  SP  registers  did  not  depend  very  much 
on  the  semi-static  and  semi-dynamic  nature  of  the  test  program.  One  possible 
exception  is  that  accumulators  A  and  B  exhibited  a  high  resistance  against  SEU 
during  the  semi-dynamic  test  and  not  in  the  semi-static  test. 


It  is  very  interesting  to  note  that  a  statistically  significant  portion 
of  the  upset  rate  is  attributable  to  the  ALU.  Although  this  device  is  a  very 
old  one,  information  about  circuit  details  relevant  to  the  design  of  the  PC 
and  ID  has  not  been  available.  Therefore,  we  have  tentatively  plotted  the 
figure  assuming  the  PCID  errors  are  equally  shared  among  the  16  bits. 

So  far,  it  has  been  worth  while  to  compare  the  vulnerability  of  various 
elements  on  a  "per-bit"  basis.  Moreover,  at  the  system  level,  power  weights 
must  be  assigned  to  the  individual  element  cross-section,  when  arriving  at  an 
overall  system  upset  cross-section.  A  simplified  approach  used  in  the  case  of 
the  6800  is  outlined  below.  The  number  of  user  available  registers  is  small 
(A,  B,  X,  SP  and  F).  We  suggest  that,  on  the  average,  a  typical  program  uses 
S,  PC,  and  a  portion  of  F  registers.  The  total  number  of  "live  and  relevant" 
bits  for  such  a  program  amounts  to  about  30.  Thus,  in  first  order,  we  can 
produce  a  device-wise  cross-section  vs  LET  curve  (the  "composite"  curve)  as 
done  for  the  bit  slice  as  before.  Of  course,  a  more  precise  curve  can  be 
obtained,  for  example,  by  a  Monte  Carlo  program.  We  also  tested  the  micro¬ 
processor  by  running  the  core  of  a  program  used  by  NASA  for  an  actual  applica¬ 
tion.  The  program  ran  in  a  loop  that  took  many  steps  to  arrive  at  a  resultant 
number  whose  value  was  checked  by  the  controller.  If  correct,  the  micro¬ 
processor  would  continue  in  the  loop.  Upon  encountering  an  error,  the  con¬ 
troller  incremented  an  external  counter  and  re-initialized  the  micro¬ 
processor.  The  results  of  this  test  are  shown  in  Figure  5c.  A  strikingly 
interesting  result  is  that  this  curve  is  very  close  to  the  composite  curve 
suggested  earlier.  We  realize  this  similarity  corroborates  the  hypothesis 
that,  in  first  order,  "device-wide"  error  rate  can  be  calculated  using  the 
cross-section  vs  LET  curve  in  Figure  5c  for  this  device. 

C.  8QC86  MICROPROCESSOR 

The  analysis  of  this  device  is  presented  to  illustrate  the  situation 
where  the  overall  device  vulnerability  is  dominated  by  the  vulnerabilities  of 
the  PC  and  instruction  decoder.  We  tested  CMOS/EPI  and  CMOS/Bulk  (the  mask 
number  was  1750).  The  latter  device  exhibited  a  high  degree  of  latch-up 
vulnerability  as  shown  in  Figure  6a,  and  made  the  soft  error  upset  data 


collection  impossible  for  LET  values  beyond  20  MeV/(mg/cra^).  The  comparison 
of  SEU  cross-sections  obtained  from  various  elements  showed  that  the  program 
counter  and  the  instruction  decoder  were  most  vulnerable.  The  composite  error 
rate  of  the  two  elements  is  at  least  one  order  of  magnitude  larger  than  the 
combined  effect  of  other  registers.  Therefore,  the  cross-section  vs  1£T  curve 
of  the  device  is  essentially  that  of  the  composite  curve  of  the  program 
counter  and  the  instruction  decoder  registers  as  shown  in  Figure  6b.  This 
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curve  can  be  used  to  obtain  the  upset  rate  in  terms  of  error/  device-day.  * 
Again,  it  is  not  proper  to  use  the  term  "errors/bit-day"  in  this  device  in 
order  to  predict  the  upset  rate. 

The  architecture  of  80C86  provides  very  high  "performance"  because  a 
pipelined  architecture  is  used  which  allows  instructions  to  be  pre-fetched 
during  spare  bus  cycles.  Clearly,  this  feature  is  the  least  desirable  from 
the  SEU  standpoint,  since  the  longer  the  instructions  stay  within  the  micro¬ 
processor  registers,  the  more  easily  they  encounter  upset.  This  device  may 
need  a  gate  level  circuit  analysis  to  detect  the  vulnerable  area. 


VI.  SUMMARY  AND  CONCLUSIONS 


Meaningful  test  methods  for  microprocessors  are  inherently  different  from 
methods  used  for  RAMs.  This  difference  carries  over  to  the  analysis  performed 
to  predict  SEU  vulnerability.  In  RAMs,  a  gate-level  analysis,  including 
circuit  simulation,  is  all  that  is  usually  needed. 

Use  of  this  approach,  followed  by  prediction  of  a  microprocessor  on  a 
"per-bit"  basis,  will  often  lead  to  an  erroneous  result. 

Even  prior  to  designing  a  test  of  a  microprocessor,  a  system  level  analy¬ 
sis  is  needed.  This  is  followed  by  the  selection  of  key  functional  elements 
for  testing. 

Use  of  the  test  data  entails  some  degree  of  reversal  of  the  process,  in 
order  to  synthesize  an  "effective"  cross-section  vs  LET  curve  that  can  be  used 
to  yield  meaningful  predictions  for  SEU  rates  in  microprocessors. 


LABORATORY  OPERATIONS 


The  Aerospace  Corporation  functions  as  an  "architect-engineer”  for 
national  security  projects,  specializing  in  advanced  military  space  systems. 
Providing  research  support,  the  corporation's  Laboratory  Operations  conducts 
experimental  and  theoretical  investigations  that  focus  on  the  application  of 
scientific  and  technical  advances  to  such  systems.  Vital  to  the  success  of 
these  investigations  is  the  technical  staff's  wide-ranging  expertise  and  its 
ability  to  stay  current  with  new  developments.  This  expertise  is  enhanced  by 
a  research  program  aimed  at  dealing  with  the  many  problems  associated  with 
rapidly  evolving  space  systems.  Contributing  their  capabilities  to  the 
research  effort  are  these  individual  laboratories: 


Aerophysics  Laboratory:  Launch  vehicle  and  reentry  fluid  mechanics,  heat 
transfer  and  flight  dynamics;  chemical  and  electric  propulsion,  propellant 
chemistry,  chemical  dynamics,  environmental  chemistry,  trace  detection; 
spacecraft  structural  mechanics,  contamination,  thermal  and  structural 
control;  high  temperature  thermomechanics,  gas  kinetics  and  radiation;  cw  and 
pulsed  chemical  and  exciraer  laser  development  including  chemical  kinetics, 
spectroscopy,  optical  resonators,  beam  control,  atmospheric  propagation,  laser 
effects  and^ countermeasures. 

Chemistry  and  Physics  Laboratory:  Atmospheric  chemical  reactions, 
atmospheric  optics,  light  scattering,  state-specific  chemical  reactions  and 
radiative  signatures  of  missile  plumes,  sensor  out-of -field-of -view  rejection, 
applied  laser  spectroscopy,  laser  chemistry,  laser  optoelectronics,  solar  cell 
physics,  battery  electrochemistry,  space  vacuum  and  radiation  effects  on 
materials,  lubrication  and  surface  phenomena,  thermionic  emission,  photo¬ 
sensitive  materials  and  detectors,  atomic  frequency  standards,  and 
environmental  chemistry. 

Computer  Science  Laboratory:  Program  verification,  program  translation, 
performance-sensitive  system  design,  distributed  architectures  for  spaceborne 
computers,  fault-tolerant  computer  systems,  artificial  Intelligence,  micro¬ 
electronics  applications,  communication  protocols,  and  computer  security. 

Electronics  Research  Laboratoty:  Microelectronics,  solid-state  device 
physics,  compound  semiconductors ,  radiation  hardening;  electro-optics,  quantum 
electronics,  solid-state  lasers,  optical  propagation  and  communications; 
microwave  semiconductor  devices,  raicrowave/mii lime ter  wave  measurements, 
diagnostics  and  radiometry,  microwave/mil limeter  wave  thermionic  devices; 
atomic  time  and  frequency  standards;  antennas,  rf  systems,  electromagnetic 
propagation  phenomena,  space  communication  systems. 

Materials  Sciences  Laboratory:  Development  of  new  materials:  metals, 
alloys,  ceramics,  polymers  and  their  composites,  and  new  forms  of  carbon;  non¬ 
destructive  evaluation,  component  failure  analysis  and  reliability;  fracture 
mechanics  and  stress  corrosion;  analysis  and  evaluation  of  materials  at 
cryogenic  and  elevated  temperatures  as  well  as  in  space  and  enemy-induced 
environments. 

Space  Sciences  Laboratory:  Magnetospheric,  auroral  and  cosmic  ray 
physics,  wave-particle  interactions ,  magnetospheric  plasma  waves;  atmospheric 
and  Ionospheric  physics,  density  and  composition  of  the  upper  atmosphere, 
remote  sensing  using  atmospheric  radiation;  solar  physics,  infrared  astronomy, 
infrared  signature  analysis;  effects  of  solar  activity,  magnetic  storms  and 
nuclear  explosions  on  the  earth's  atmosphere,  ionosphere  and  magnetosphere; 
effects  of  electromagnetic  and  particulate  radiations  on  space  systems;  space 
Instrumentation. 
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